Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
Re: Hifn crypto driver: does it work for anyone?
From: Thor Lancelot Simon (tlsrek.tjls.com)
Date: Sun Oct 16 2005 - 16:49:28 CDT
On Sun, Oct 16, 2005 at 04:35:03PM -0400, Thor Lancelot Simon wrote:
> However, that same machine still displays the symptom where the whole
> crypto subsystem grinds to a halt after it's run for a minute or so (and
> a few tens of kilobytes of traffic via ipsec, plus a few megabytes via
> OpenSSH's use of /dev/crypto have flowed through). I'm rebuilding it
> with options KTRACE so at least I can see what error code, exactly,
> the /dev/crypto operations are returning. When this happens, IPsec
> traffic stops too.
So, more to report: a 7955 on Soekris VPN1401 card works fine in my
desktop machine, with the patch; but a 7955 on Soekris VPN1411 does
not work in my Soekris 4501 router, displaying the "grinds to a halt"
symptom described above and in earlier messages. I was hopeful that
this was just a result of the Soekris PCI BIOS misconfiguring the
card, but the most recent Soekris BIOS seems to get things right (sane
latency values, and bus mastering enabled -- unlike the very old BIOS I
had before) and the problem is, if anything, worse.
What's going on with /dev/crypto when things get jammed up is that
OpenSSL tries to call CIOCCRYPT and it fails with ENOMEM:
476 openssl CALL ioctl(7,CIOCCRYPT,0xbfbfe5d0)
476 openssl GIO fd 7 wrote 28 bytes
476 openssl RET ioctl -1 errno 12 Cannot allocate memory
Note that you can't use "openssl speed" to see this, there seems to be
a bug in openssl speed such that it never uses /dev/crypto. But you
can encrypt a small file with "openssl aes-128-cbc" or "openssl des-cbc"
and see the problem.
This seems to be the same problem described by an OpenBSD user at
I have, in fact, seen the "overrun" and "resetting" messages once (albeit
before upgrading the Soekris BIOS).
Sam, Jonathan? How can I best see where the ENOMEM is percolating up
Thor Lancelot Simon tlsrek.tjls.com
"The inconsistency is startling, though admittedly, if consistency is to be
abandoned or transcended, there is no problem." - Noam Chomsky